We can advance online safety in an encrypted world

Encryption is a hotly debated topic and for good reason. There are those who argue encryption weakens online safety efforts, particularly those related to young people, and others that argue encryption continues to advance and strengthen safety. Regardless of where you fit in the discussion, we can advance online safety in an encrypted world.

Recent threats by WhatsApp and Signal to exit the UK rather than comply with clause 110 in The UK Online Safety Bill, highlights the clash between the advancement of End to End Encryption (E2EE) and its impact on law enforcement efforts.

This example demonstrates both sides of the debate. It pits increased privacy against increased safety – and is felt most keenly in relation to its impact on the detection of Child Sexual Abuse Material (CSAM).  

Neither side will win the debate because both sides are simultaneously right.

E2EE does enhance privacy and safety online – and users have come to expect this. It is also true that increased use of E2EE will result in less detection of CSAM content – and that criminals will use encrypted platforms to secretly move harmful content.

The future will be encrypted because encryption exists, and it offers benefits. Rather than resist the rise of encryption, the online safety community should work to develop safety solutions that are effective in an encrypted world. The foundations of these solutions already exist and can arguably be enhanced to do a better job of reducing harm online than current content detection-based systems.  

E2E Encryption brings safety benefits

It important to recognise that End-to-End encryption advances some important public safety outcomes. It is a critical privacy tool preventing content from being intercepted or accessed. It protects our data when it is lost by organisations through data breaches. It protects your privacy in a world that increasingly fails it.

The value of E2EE is exponentially greater for individuals that are at increased risk. E2EE is often touted as critical to human rights defenders and freedom fighters – which is true. But it is not just a tool for people hiding from corrupt regimes, it is also a valuable tool for the protection of children and victims of domestic violence.

Encryption benefits are removed by backdoors

There have been proposals to force all encrypted service providers to keep keys or backdoors available to law enforcement if they require it. If those keys or backdoors exist, they will be found and exploited by criminals, bad state actors, or even malicious staff. If they exist –  encrypted data is never truly safe, which defeats the point of E2EE.

There are already many encrypted platforms

Popular messaging apps like WhatsApp, Signal, Telegram, and Viber are encrypted. Major email platforms are encrypted. Much of the web is encrypted – and the entire dark web is. This means criminals already have many platforms to choose from, and transmit content, that is invisible to law enforcement.

Criminals will continue to use encryption to avoid detection

Encryption technology exists. Even if major platforms do not integrate it and make it easily accessible to the masses– it will still be available for criminal use. If somebody is already guilty of trading in child sexual abuse material, or extremist content – they will not be concerned about the legality of the use of encryption tools.  

Increased encryption will reduce content detection and reporting

The majority of CSAM detected is found on unencrypted platforms. The majority of those reports are made by Meta which provided 93 percent of all reports to NCMEC in 2020. If Meta encrypts its last open platforms – reporting volumes will dramatically drop. That is why plans to encrypt Messenger created such a concern back in 2021.

The volume of content moving on encrypted platforms is unknown.  

Reports are a tool, not the objective

The objective of anti-CSAM activity is a reduction in the production and trade of CSAM – and ultimately the protection of children. Content reports are one tool that is used to locate offenders and victims. It has been an important contributor to the work – but its time as the primary tool is nearing an end. Technology progresses forward – and we have to evolve with it.

It’s the data economy stupid

End to End and content encryption does not make criminal activity invisible. In 2019, an encrypted platform was able to detect tens of thousands of offenders that were using that platform to share CSAM and collaborated with law enforcement to ultimately enable the safeguarding of 146 children.

Even when the content people are moving is hidden, there is still valuable information that can be seen. Even when we don’t know what is transmitted – we know when it was, by who, and how. Every online transaction creates data which can be analysed – and from which increasingly accurate predictions can be made.

Tech platforms already capture and effectively analyse this data for commercial purposes. It can equally be analysed to identify probable criminal activity. In fact, this process should enable earlier detection and intervention of offenders and potential victims.

It’s time to increase cooperation and focus regulation

There are a number of things that will have to change to enable these post encryption safety interventions to be successful. It will require the development of new tools and increased cooperation between tech platforms and law enforcement. That cooperation will need to be underpinned by regulation that recognises and appropriately enables the sharing of data and information – and sets the parameters for triggering enforcement and safety interventions.

These new approaches represent a far more complex proposition than simple compulsory reporting schemes, but they also represent an opportunity to massively improve the detection and prevention of criminal activity online.

We should get on with it.